U.S. Data Processing Addendum (DPA)

1. Statutory Service Provider / Processor Commitments

When RestoHub Inc. (“Service Provider” / “Processor”) Processes Customer Personal Data on behalf of a Merchant Restaurant (“Business” / “Controller”) under the CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, TDPSA, OCPA, and all other enacted U.S. state data privacy statutes, RestoHub certifies that it shall not:

• Sell or Share Customer Personal Data for monetary value or cross-context behavioral advertising;
• Retain, use, or disclose Customer Personal Data for any purpose other than performing and securing the Cloud Services specified in the MSA (or permitted statutory Service Provider exemptions);
• Retain, use, or disclose Customer Personal Data outside the direct business relationship between RestoHub and the Merchant; or
• Combine Customer Personal Data with third-party data sets except as permitted by law to detect security incidents, prevent fraud, or maintain multi-tenant platform integrity.

2. Security Incident Notification, DSAR Assistance & Deletion

RestoHub binds all authorized personnel to written confidentiality obligations, assists Merchants with verified Consumer Privacy Requests (Access, Delete, Correct, Opt-Out), notifies Merchants without undue delay (and within 72 hours of confirmation) of any confirmed Security Incident affecting unencrypted Customer Personal Data, and deletes or de-identifies Customer Personal Data following the 30-day post-termination CSV export window (subject to mandatory IRC § 6050W tax and payment retention laws).

Annex 1 & Annex 2 — Processing Scope & Security Measures

• Data Subjects & Categories: Restaurant Diners, Staff, and Authorized Drivers (names, contact info, delivery addresses, Orders, shift timestamps, active-shift driver route GPS, and tokenized payment references).
• Encryption: TLS 1.2/1.3 in transit across Cloudflare edge and AES-256 at rest in Supabase PostgreSQL.
• Tenant Isolation: PostgreSQL Row-Level Security (RLS) enforcing strict business_id isolation across every database table.
• PCI-DSS Card Isolation: Zero storage of raw card PANs or CVCs on RestoHub servers (captured directly by Stripe Elements / Stripe Terminal).

Annex 3 — Authorized Infrastructure Subprocessors

Merchants receive at least 15 days' advance notice of any new material Subprocessor and may submit reasonable data-protection objections to contact@restohub.us.